[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-07-31 (世界標準時間)。"],[],[],null,["Workload Identity Federation for GKE (WIF) is a mechanism that lets your cluster's\nworkloads access external cloud resources with Kubernetes Service Accounts. WIF\nis the recommended way for applications running within GKE attached clusters\nto access Google Cloud services. When you register your cluster, the\nGKE attached clusters API creates all the infrastructure required for WIF, with\nsupport for clusters that use either public or private OIDC issuers.\n\nAll GKE components that connect back to Google Cloud,\nsuch as Connect and telemetry agents, use Workload Identity Federation for GKE.\n\nKubernetes service accounts and Workload Identity Federation for GKE\n\nWhen a Pod runs, it uses a\n[Kubernetes service account](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/)\nto authorize its access to resources hosted within its cluster. By using\nWIF, the Pod can use the same Kubernetes Service\nAccount (KSA) to obtain a short-lived token to access resources hosted outside\nthe cluster.\n\nWIF requires a trust relationship between the OIDC identity provider inside the\ncluster and the external resource provider, such as Google Cloud IAM. When you register\nan Attached Cluster, the registration process automatically creates this trust\nrelationship by adding your cluster's OIDC service to the default workload\nidentity pool bound to your Google Cloud project.\n\nThis workload identity pool is your Google project's pool of trusted identity\nproviders and is named `PROJECT_ID.svc.id.goog`, where `PROJECT_ID` is the\nGoogle Project ID associated with your attached cluster.\n\nYou can use regular Google Cloud IAM policies to control access by Kubernetes Service\nAccounts to Google Cloud services. Kubernetes Service Account principals are the\nrepresentation of the KSA within the workload identity pool. They're\nformatted as following: \n\n serviceAccount:WORKLOAD_IDENTITY_POOL_NAME[KSA_NAMESPACE/KSA_NAME]\n\nTo grant a role to the Kubernetes service account, use the following command: \n\n gcloud projects add-iam-policy-binding \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e \\\n --member=\"serviceAccount:\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e.svc.id.goog[\u003cvar translate=\"no\"\u003eKSA_NAMESPACE\u003c/var\u003e/\u003cvar translate=\"no\"\u003eKSA_NAME\u003c/var\u003e]\" \\\n --role=\u003cvar translate=\"no\"\u003eIAM_ROLE\u003c/var\u003e\n\nReplace:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: your Google Cloud project ID\n- \u003cvar translate=\"no\"\u003eKSA_NAMESPACE\u003c/var\u003e: the cluster namespace that this service account resides in\n- \u003cvar translate=\"no\"\u003eKSA_NAME\u003c/var\u003e: the name of the Kubernetes service account you want to grant permissions to\n- \u003cvar translate=\"no\"\u003eIAM_ROLE\u003c/var\u003e: the Google Cloud role you want to grant to this KSA"]]
